A Security Operations Center (SOC) analyst receives an automated alert from a network intrusion detection system (NIDS) flagging potential command-and-control (C2) beaconing activity from an internal workstation. Place the following incident triage and response steps in the correct chronological order from first to last.
- 1Inspect raw packet captures and flow logs to validate that the alert is a true positive.
- 2Isolate the compromised workstation from the local network to sever the active C2 session.
- 3Deploy custom block rules on perimeter firewalls using the newly identified malicious IP address.
- 4Document the incident findings and update the network security monitoring baseline signatures.
Cevap
The correct sequence begins with validating the NIDS alert using raw packet captures and flow logs, followed by isolating the compromised workstation, deploying custom firewall block rules for the C2 IP, and concluding with incident documentation and updating network monitoring baselines.
The standard network security monitoring triage flow requires validating the security alert with raw telemetry first to confirm true positive status. Once validated, containment actions such as host isolation are performed immediately to block active command-and-control communication. Following containment, preventive controls like firewall block rules are updated across the network perimeter. Finally, the analyst completes post-incident procedures by documenting findings and updating monitoring baselines.
Adım Adım Çözüm
Anahtar Kavram
Incident triage and containment workflow for network security alerts